Noro External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Noro External.exe
Size 2.4MB
Sample261110-2tj3dacb39
SHA256 175a3b73e3eba947c89206887973aa4cb3ea8210e3a9bb46da7128db76075ab7
MD5 7a137dbfbc9bf134456daffd536d8f3e
SHA1 7abdf7e8c0e940e11e11231b012f108e3c1dcc77
SHA512 34745b384630e7700f9cbbbc48e0d2cb2b90a800c1577b2b0911622560883c8b09e388f93218e44a9f7d64e7fbca14ae9c75751fc3d64a515afe9954fe5175da
SSDEEP 49152:0PEHmy+eDuttlc0AqNIRZfty4yZZWeumTCUyTMnMErI5yDxKe:IPe6iRZfty4yZZWe3TazcK
TLSH
T144C5AE5BA3D944A8D073E178C7555A0BE7717018032086EB3BE449A95F7B6D0ABBFF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Noro External.exe

File Explorer

Noro External.exe

.exe 2.4MB

Noro External.exe

IMPHASH 86c090a1b35d73e388a077a1d891cdcf
SHA256 175a3b73e3eba947c89206887973aa4cb3ea8210e3a9bb46da7128db76075ab7
MD5 7a137dbfbc9bf134456daffd536d8f3e
SHA1 7abdf7e8c0e940e11e11231b012f108e3c1dcc77
SHA512 34745b384630e7700f9cbbbc48e0d2cb2b90a800c1577b2b0911622560883c8b09e388f93218e44a9f7d64e7fbca14ae9c75751fc3d64a515afe9954fe5175da
SSDEEP 49152:0PEHmy+eDuttlc0AqNIRZfty4yZZWeumTCUyTMnMErI5yDxKe:IPe6iRZfty4yZZWe3TazcK
TLSH
T144C5AE5BA3D944A8D073E178C7555A0BE7717018032086EB3BE449A95F7B6D0ABBFF02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1243736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\s\Desktop\Usefull\C++ Projects\Noro\Noro External DEV\Noro External\Noro External\x64\Release\fncheat.pdb

kernel32

HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread CreateFileMappingW UnmapViewOfFile GetModuleFileNameW GetModuleHandleW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx GetSystemInfo MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx GlobalAlloc OutputDebugStringW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW GetCurrentThread HeapReAlloc FindFirstFileW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter HeapAlloc HeapDestroy GetLastError CreateFileW CheckRemoteDebuggerPresent IsDebuggerPresent OpenThread VirtualQuery SetDllDirectoryW SetThreadContext QueryFullProcessImageNameW CreateFileA GetTickCount64 CreateToolhelp32Snapshot OpenProcess GetSystemDirectoryW GetCurrentThreadId Module32NextW ExitProcess LocalFree GetThreadContext Thread32First Thread32Next WriteFile GetCurrentProcess AddDllDirectory SetDefaultDllDirectories VirtualProtect GetTickCount MapViewOfFile CreateProcessA GetCurrentProcessId CreateFileMappingA GetWindowsDirectoryA CloseHandle GetFileAttributesA Sleep WaitForSingleObject SetConsoleTitleA GetModuleFileNameA CreateDirectoryA DeleteFileA FindClose FindNextFileA FindFirstFileA QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA AddVectoredExceptionHandler Module32FirstW K32GetModuleInformation Process32FirstW Process32NextW GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree MultiByteToWideChar

user32

UnregisterClassA PostQuitMessage GetDesktopWindow FindWindowA RegisterClassExA UpdateWindow SetForegroundWindow IsIconic GetAsyncKeyState GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout PeekMessageA LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData FindWindowW LoadIconW TranslateMessage SetLayeredWindowAttributes CreateWindowExA DefWindowProcA GetWindowLongA SetWindowLongA BringWindowToTop SetFocus GetForegroundWindow DispatchMessageW MessageBoxA GetWindowRect DestroyWindow SetWindowPos IsWindow ShowWindow GetSystemMetrics SetActiveWindow MessageBoxW keybd_event

advapi32

RegDeleteKeyA CryptReleaseContext AddAccessAllowedAce CryptGetHashParam GetLengthSid SetSecurityInfo InitializeAcl RegOpenKeyExA OpenProcessToken CryptDestroyHash IsValidSid CryptHashData CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptAcquireContextW ConvertSidToStringSidA CopySid GetTokenInformation RegCreateKeyExA RegCloseKey SetEntriesInAclW CryptCreateHash

shell32

ShellExecuteA ShellExecuteW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Query_perf_counter ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1_Lockit@std@@QEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?id@?$ctype@D@std@@2V0locale@2@A _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Thrd_id _Thrd_join _Xtime_get_ticks ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Xbad_function_call@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency

d3d11

D3D11CreateDeviceAndSwapChain

winmm

timeBeginPeriod timeEndPeriod

ws2_32

send WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSAStartup ntohl getaddrinfo freeaddrinfo WSAWaitForMultipleEvents inet_pton inet_ntop getsockopt closesocket WSAGetLastError ntohs gethostname ioctlsocket sendto recvfrom listen htonl WSASetLastError accept select WSACleanup __WSAFDIsSet bind WSAIoctl socket connect getpeername setsockopt recv getsockname htons WSACloseEvent

crypt32

CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertCreateCertificateChainEngine CryptQueryObject CertOpenStore CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

userenv

UnloadUserProfile

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

ntdll

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

psapi

GetModuleInformation

shlwapi

PathFindFileNameW

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memmove strrchr wcschr __current_exception __current_exception_context memcpy memcmp memchr _CxxThrowException strchr __std_exception_destroy __std_exception_copy strstr wcsstr __std_terminate __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

_read _write __stdio_common_vsscanf fputs _fileno _close feof _set_fmode ftell fputc __stdio_common_vsprintf fgetc __p__commode _popen __acrt_iob_func _wfopen fwrite _lseeki64 fgetpos setvbuf ungetc fsetpos _fseeki64 _pclose fgets _get_stream_buffer_pointers fclose __stdio_common_vfprintf fflush _wopen fread fseek

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

_wcsicmp isxdigit wcsncmp isspace _stricmp strpbrk towlower wcsncpy strcmp strlen wcslen _wcsdup tolower strspn strncpy strncmp strcspn _strdup wcspbrk strcpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh calloc malloc free _set_new_mode realloc

api-ms-win-crt-convert-l1-1-0

strtof atoi strtol strtod wcstombs strtoll atof strtoul strtoull

api-ms-win-crt-runtime-l1-1-0

_beginthreadex exit _errno __sys_errlist system __sys_nerr _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type abort _get_initial_narrow_environment _initterm _initterm_e _exit _invoke_watson __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _resetstkoflw terminate

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file _fstat64 _lock_file _wstat64

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64_s _localtime64 strftime _time64

api-ms-win-crt-math-l1-1-0

powf _dclass pow sinf tanf sqrt fmodf sqrtf expf atan2 asin acosf _fdopen cosf _fdclass _dsign ceilf __setusermatherr atanf atan2f

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func